Text 12416, 200 rader
Skriven 2006-08-04 20:07:58 av Geo (1:379/45)
Kommentar till text 12407 av John Beckett (1:379/45)
Ärende: Re: Microsoft Windows DHCP Client Service Remote Code Execution Vulnera
===============================================================================
From: "Geo" <georger@nls.net>
This is a multi-part message in MIME format.
------=_NextPart_000_0061_01C6B801.AE68F530
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
"John Beckett" <FirstnameSurname@compuserve.com.omit> wrote in message =
news:5m46d2ti86jtahsh24pbq4geindupc8gii@4ax.com...
> Suppose you have network1 and network2 joined by a router.
> Normal DHCP traffic on network1 will be broadcast to 255.255.255.255, =
and
> the router will not forward that traffic to network2.
>=20
> However, if you Google "directed broadcast" (with quotes), you will =
see
> that a router WILL forward traffic from network1 to the broadcast =
address
> of network2, and the router on network2 WILL broadcast the packet.
Only if the router is configured to forward the traffic, typically an =
internet router would not be setup to do this. Here is the dhcp process =
(found a good description) Notice the second step where they describe a =
router with bootp relay enabled. Without that configured I don't see how = you
can begin a dhcp process.
Geo.
DHCP (Dynamic Host Configuration Protocol)
DHCP works slightly differently from Bootp. The following steps occur = when a
client retrieves IP configuration details from a DHCP server:=20
a.. The client sends a DHCPDISCOVER IP broadcast to find available =
DHCP servers on its subnet. This broadcast message could give = indications of
the address required and the length of the lease.=20
b.. A router configured with Bootp Relay agent forwards the request on =
to other subnets specified in the router configuration (e.g. Cisco's ip =
helper).=20
c.. The DHCP server responds with a unicast DHCPOFFER containing an =
available IP address in the 'Your IP Address' field and other = configuration
parameters such as default gateway, subnet mask and lease = time. This occurs
when the DHCPDISCOVER has a 0 in the Client IP address = field. The server
should check that the IP address has not already been = allocated. Optionally,
the server could be configured to reserve = previously allocated IP addresses.
In the case of the server being on a = different subnet to the client, this
DHCPOFFER is sent to the client's = router's LAN IP address which is the source
of the original DHCPDISCOVER = broadcast. Where the server and the client sit
on the same LAN, the MAC = address of the client is sufficient, being as it is
the source of the = broadcast.=20
d.. The client examines the various offers it receives, picks one and =
sends a DHCPREQUEST broadcast including the server identifier of that =
particular server to obtain the offered configuration parameters. The =
DHCPREQUEST broadcast is also used to renew a lease or to decline an =
offer.=20
e.. All servers receive this broadcast if they are on the LAN. If they =
are on another subnet and a relay agent is configured on the router, = then
this broadcast is unicast to the server identified by the server = identifier.
The router is configured with the IP address of the desired = server.=20
f.. The chosen server replies with a unicast DHCPACK containing IP =
address, duration for the lease of that IP address and the other =
configuration parameters. The server commits to this IP address and it = is
passed to persistent memory. A DHCPNACK is sent if the IP address = happens to
have been allocated in the meantime.=20
g.. The client receives the DHCPACK and checks the IP address is not =
being used locally e.g. with an ARP request. If the IP address IS in use = then
the client sends a DHCPDECLINE, waits at least 10 seconds and then = restarts
the process.=20
------=_NextPart_000_0061_01C6B801.AE68F530
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1555" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV><FONT face=3DArial size=3D2>"John Beckett" <</FONT><A=20
href=3D"mailto:FirstnameSurname@compuserve.com.omit"><FONT face=3DArial=20
size=3D2>FirstnameSurname@compuserve.com.omit</FONT></A><FONT = face=3DArial=20
size=3D2>> wrote in message </FONT><A=20
href=3D"news:5m46d2ti86jtahsh24pbq4geindupc8gii@4ax.com"><FONT =
face=3DArial=20
size=3D2>news:5m46d2ti86jtahsh24pbq4geindupc8gii@4ax.com</FONT></A><FONT =
face=3DArial size=3D2>...</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>> Suppose you have network1 and =
network2 joined=20
by a router.<BR>> Normal DHCP traffic on network1 will be broadcast = to=20
255.255.255.255, and<BR>> the router will not forward that traffic to =
network2.<BR>> <BR>> However, if you Google "directed broadcast" =
(with=20
quotes), you will see<BR>> that a router WILL forward traffic from =
network1=20
to the broadcast address<BR>> of network2, and the router on network2 =
WILL=20
broadcast the packet.<BR><BR></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Only if the router is configured to =
forward the=20
traffic, typically an internet router would not be setup to do this. = Here is
the=20
dhcp process (found a good description) Notice the second step where = they=20
describe a router with bootp relay enabled. Without that configured I = don't
see=20
how you can begin a dhcp process.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV>
<H2 class=3Dheading2><FONT face=3DArial size=3D2>DHCP (Dynamic Host =
Configuration=20
Protocol)</FONT></H2><BR>
<DIV><FONT face=3DArial size=3D2>DHCP works slightly differently from =
Bootp. The=20
following steps occur when a client retrieves IP configuration details = from
a=20
DHCP server: </FONT></DIV>
<UL>
<LI><FONT face=3DArial size=3D2>The client sends a DHCPDISCOVER IP =
broadcast to=20
find available DHCP servers on its subnet. This broadcast message =
could give=20
indications of the address required and the length of the lease. =
</FONT>
<LI><FONT face=3DArial size=3D2>A router configured with Bootp Relay =
agent=20
forwards the request on to other subnets specified in the router =
configuration=20
(e.g. Cisco's ip helper). </FONT>
<LI><FONT face=3DArial size=3D2>The DHCP server responds with a =
unicast DHCPOFFER=20
containing an available IP address in the 'Your IP Address' field and =
other=20
configuration parameters such as default gateway, subnet mask and =
lease time.=20
This occurs when the DHCPDISCOVER has a 0 in the Client IP address =
field. The=20
server should check that the IP address has not already been =
allocated.=20
Optionally, the server could be configured to reserve previously =
allocated IP=20
addresses. In the case of the server being on a different subnet to =
the=20
client, this DHCPOFFER is sent to the client's router's LAN IP address =
which=20
is the source of the original DHCPDISCOVER broadcast. Where the server =
and the=20
client sit on the same LAN, the MAC address of the client is =
sufficient, being=20
as it is the source of the broadcast. </FONT>
<LI><FONT face=3DArial size=3D2>The client examines the various offers =
it=20
receives, picks one and sends a DHCPREQUEST broadcast including the =
server=20
identifier of that particular server to obtain the offered =
configuration=20
parameters. The DHCPREQUEST broadcast is also used to renew a lease or =
to=20
decline an offer. </FONT>
<LI><FONT face=3DArial size=3D2>All servers receive this broadcast if =
they are on=20
the LAN. If they are on another subnet and a relay agent is configured =
on the=20
router, then this broadcast is unicast to the server identified by the =
server=20
identifier. The router is configured with the IP address of the =
desired=20
server. </FONT>
<LI><FONT face=3DArial size=3D2>The chosen server replies with a =
unicast DHCPACK=20
containing IP address, duration for the lease of that IP address and =
the other=20
configuration parameters. The server commits to this IP address and it =
is=20
passed to persistent memory. A DHCPNACK is sent if the IP address =
happens to=20
have been allocated in the meantime. </FONT>
<LI><FONT face=3DArial size=3D2>The client receives the DHCPACK and =
checks the IP=20
address is not being used locally e.g. with an ARP request. If the IP =
address=20
IS in use then the client sends a DHCPDECLINE, waits at least 10 =
seconds and=20
then restarts the process. </FONT></LI></UL></DIV></BODY></HTML>
------=_NextPart_000_0061_01C6B801.AE68F530--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|